CVE-2026-10580

WordPress - Hippoo Mobile App for WooCommerce = 1.9.4 - Authentication Bypass to Admin Account Takeover Overview This tool is a proof-of-concept exploit for CVE-2026-10580 , an authentication bypass vulnerability affecting the Hippoo Mobile App for WooCommerce WordPress plugin versions = 1.9.4. T...

CVE-2026-105703 PHPGurukul User Registration & Login and User Management System Change Password change-password.php authorization

A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown function of the file loginsystem/admin/change-password.php of the component Change Password Handler. This manipulation of the argument currentpassword causes...

CVE-2026-105703

The PHPGurukul User Registration & Login and User Management System 3.3 is vulnerable to an incorrect authorization flaw within the Change Password Handler component. Specifically, an unknown function in the file loginsystem/admin/change-password.php fails to properly validate the currentpassword...

EUVD-2026-92938

A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown function of the file loginsystem/admin/change-password.php of the component Change Password Handler. This manipulation of the argument currentpassword causes...

CVE-2026-71205-PoC

CVE-2026-71205 — changedetection.io: No Rate Limiting on /login Enables Unlimited Password Brute-Force Product: dgtlmoon/changedetection.io — v0.55.7 File: changedetectionio/flaskapp.py CWE: CWE-307 — Improper Restriction of Excessive Authentication Attempts CVSS 3.1:...

Zoho ManageEngine - Remote Code Execution

Zoho ManageEngine Password Manager Pro, PAM 360, and Access Manager Plus are susceptible to unauthenticated remote code execution via XML-RPC. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary...

Zoho ManageEngine - Access Control Bypass

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize via the ../RestAPI...

wargame-turkey_in_2

wargame 1. flag file divide 2. Brute force prevent - delay 50005s 3. logging 4. password hashing -wargame-turkeyin2...

CVE-2025-63353

FiberHome Wi-Fi Password Predictor CVE-2025-63353 A Python utility designed for security auditing and proof-of-concept demonstration of the deterministic password generation flaw found in FiberHome HG6145F1 RP4423 routers. 📋 Overview This script exploits CVE-2025-63353, a critical vulnerability...

onedrive_user_enum

onedriveuserenum v2.10 enumerate valid onedrive users For a full rundown of the enumeration technique and OneDrive enum, check out the blog here: https://www.trustedsec.com/blog/onedrive-to-enum-them-all/ If you are looking for the old, non-database vesion of OneDrive Enum, you can find it here:...

DEBIAN-CVE-2026-92821

A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP Lightweight Directory Access Protocol environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote...

EUVD-2026-92806

openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staffid and cause the School Information update path to reset that selected account's password...

CVE-2026-105785

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and...

EUVD-2026-92894

A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP Lightweight Directory Access Protocol environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote...

CVE-2026-92821

A vulnerability exists in SSSD where improper configuration allows an access control bypass in LDAP environments. If the system is configured to evaluate password expiration warnings before restrictive access rules, an expired-password warning causes the rule evaluation to terminate early, treati...

CVE-2026-92821 Sssd: sssd: access control bypass via premature ldap access rule evaluation

A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP Lightweight Directory Access Protocol environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote...

CVE-2026-92821

A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP Lightweight Directory Access Protocol environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote...

PT-2026-106292

A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP Lightweight Directory Access Protocol environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote...

PT-2026-106317

A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown function of the file loginsystem/admin/change-password.php of the component Change Password Handler. This manipulation of the argument currentpassword causes...

PT-2026-106779

Name of the Vulnerable Software and Affected Versions Payload versions 3.0.0 through 3.89.9 Payload versions 4.0.0-canary.0 through 4.0.0-canary.33 Description A user capable of querying a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, such as...